Ask HN: Independently learning design? - <AUTHOR> I'm a self-taught programmer (iOS and some back end web). Here on hacker news and also on other forums and startup news sites, I always see information on learning to code. The standard routes are codeacademy, certain recommended books, types of projects to get started out on, etc. As recent as yesterday I saw a post on properly learning javascript. It was inspiring, but more so, it went in to such detail on a 6 week method one could follow.<p>Are the same sources out there to learn design? Books, apps, certain forums that designers look to (akin to stackoverflow)? <comment><USER2> Go to art school, like I did. Hahahah. No, I'm kidding, don't. But do become educated about the past. Buy some books. I recommend starting with Paul Rand <http://www.amazon.com/Paul-Rand-Steven-Heller/dp/0714839949> I love that book. I'll never let go of my copy.

The most important thing is not to focus too much on current trends. They're mostly bullshit that will be forgotten fast. The reason I say study the past is because everything old that has been documented is actually worth studying. It's "stood the test of time," if you will.

I think a lot of designers today focus too much on what's happening NOW, reading today's blogs and knowing the trends and whatever. So they go make things with an extremely narrow perspective and think they're designing when really they're retracing the only thing they know.

People don't know nearly enough on say, 50's modernism. Or the Bauhaus aesthetic. Watch the Eameses' films. Know the greats. Respect them. Broaden your awareness. Graphic design was huge before computers.

Then apply the broad ideas you absorb from that to the medium you're working in. That's my advice. There's no Stack Overflow for design. It doesn't work the same way as programming. You're not going to become a good designer by visiting websites.

<comment><USER3> _> There's no Stack Overflow for design._

There are actually two stack exchange sites for design:

\- <http://ux.stackexchange.com/>

\- <http://graphicdesign.stackexchange.com>

I've used both and found them very useful.

 _> It doesn't work the same way as programming. You're not going to become a good designer by visiting websites._

No one becomes a solid programmer by visiting websites either. It's about practice with a focused effort on improving, just like any other skill. I would be amazed if design were any different.

<comment><USER2> I'm aware of those, I've been to both. I agree that ux.stackexchange has something to offer. graphicdesign.stackexchange is basically an Adobe support site.

Programming problems are much easier to solve with a Google search. In programming, the state of the art _is_ the most important state. Nobody really reads or studies historical code from obsolete technology. Sure, there are things you won't learn without a good mentor or teacher.

My intention wasn't to claim you can become a good programmer by visiting websites, I was just trying to express that learning design is a much more offline experience, and OP was asking for websites he should visit.

</comment></comment></comment><comment><USER4> <http://hackdesign.org/> is trying to cover this exact niche (I'm following along as a designer just out of curiosity, and it's pretty cool).

Mark Boulton's A Practical Guide to Designing for the Web (Five Simple Steps) [http://www.amazon.co.uk/dp/0956174019/ref=cm_sw_r_tw_dp_f- cg...](http://www.amazon.co.uk/dp/0956174019/ref=cm_sw_r_tw_dp_f-cgrb0TZS0EN) is also a good start.

There are the usual suspects such as Nettuts, Smashing Mag, Core77, Creative Review, Design Observer (though that's more intense).

For web typography, try <http://kaikkonendesign.fi/typography/> and the older (but based on a lauded print book for print type design) <http://www.webtypography.net/>

Just for the insight into the nutty world of type design, I like the MyFonts newsletter: <http://www.myfonts.com/newsletters/cc/201301.html>

If you want to get more into IXD, Cooper has a good list: [http://www.cooper.com/journal/2013/01/self-study- interaction...](http://www.cooper.com/journal/2013/01/self-study-interaction- design.html)

<comment><AUTHOR> HackDesign looks awesome!

</comment></comment><comment><USER5> In my experience the very best way to develop design chops is to get a sense of the kind of design you like, and then let that influence the look and feel of your own projects.

At first you will be copying other peoples' style and that is okay. As you proceed and improve you'll start doing your own thing. Great artists steal, etc.

Of course, without your own projects, you'll get nowhere, as has been pointed out.

Design it Yourself is a pretty good read: <http://amzn.to/UV6jFV>

As an aside, there's very little of the camaraderie/collaboration you're probably used to from the hacker world in the design world. (Though <http://hackdesign.org/> looks rad!) No one has written The Cathedral and the Bazaar for design yet. Know that upfront and you won't be surprised when designers act more afraid than excited at the prospect of unskilled hackers trying their hand at design.

Don't buy into the suggestion you need to worship 'the masters' of graphic design to learn to do your own thing. The web is not just paper that you can click, it's a new medium. You'll learn as much studying design on the web as you will from books.

</comment><comment><USER6> I'm in the same boat. I'm not very good but I'm starting to get better at design. Here are some tips, which might be useful. None of these are affiliate links and I'm not associated with any of them, if that matters.

\- It's cliche, but read "The Design of Everyday Things" by Donald Norman [1]. It gives you a good sense of design's place in the greater world. The best design principles are as at home in a product development firm as they are in the software world.

\- I own "Design for Hackers" by David Kadavy and I think it's pretty good. The content may or may not be "obvious" depending on your skill level, but he phrases things in a way that is understandable and reassuring to the engineering set. [2]

\- There's a guy on HN (Jarrod Drysdale) who produced an eBook called "Bootstrapping Design". I haven't pulled the trigger on a purchase yet, but I need to. I've read his sample chapter and am subscribed to his newsletter and I think he's an excellent coach. [3]

\- I keep a bookmark folder called "design inspiration" and when I find really cool sites or apps I save them here. You might also want to keep a clipping diary or something where you can keep notes for yourself about what you like and don't like about certain things.

\- There's nothing wrong with imitation, within reason. EVERYONE stands on the shoulders of giants and the guy who designed that awesome site or app probably started by shamelessly copying existing stuff. In fact, I recommend that you spend some time trying to EXACTLY copy things you like. You'll start to get a feel for how to accomplish certain affects and, in general, you'll get design a little more "in the fingers".

\- <http://ux.stackexchange.com/>

\- Have a project. Have a project. HAVE A PROJECT. It's very difficult to just "learn design", just as it's very difficult to just "learn programming". Unless you're just a natural autodidact, you can read all the tutorials and books and whatever but, when it comes time to do something on your own, you'll just be sitting there staring at a blinking cursor (or an empty Photoshop document) unless you have _some place_ to start.

I hope this all helps, and don't be afraid to share stuff on HN with us. There are plenty of folks who would love to give you positive criticism and feedback.

[1] [http://www.amazon.com/Design-Everyday-Things-Donald- Norman/d...](http://www.amazon.com/Design-Everyday-Things-Donald- Norman/dp/0465067107)

[2] [http://www.amazon.com/Design-Hackers-Reverse-Engineering- Bea...](http://www.amazon.com/Design-Hackers-Reverse-Engineering- Beauty/dp/1119998956)

[3] <http://bootstrappingdesign.com/>

<comment><USER7> <http://hackdesign.org/> is what I am using

<comment><USER8> Hack design is really awesome. It goes down from what is design, understanding design on everything we do, to typography and next on.

</comment></comment></comment><comment><USER9> One method that I've found useful is to completely re-create somebody else's design in Photoshop. Find a website that you really like, take a screenshot of it, paste it into Photoshop, and recreate the whole thing.

The benefit of doing this is three-fold. For one, you are more than likely not going to functionally know how to re-create some effects which will force you to go out and read targeted tutorials. Second, you will notice the subtleties of the design that you are unlikely to notice when just looking, which will help build your design intuition. Lastly, you won't waste time trying to come up with an idea and failing through the execution; you will start with something great and end with something (hopefully) great.

Clearly this isn't the way to learn the creative side of design, but it will build up your skill-set such that you will actually be able to execute when you have a vision.

<comment><USER10> I can vouch for this method. I've been coding since childhood and developing websites for the past ~15 years, but I never quite figured out how to get designs in my head on to paper (or into Photoshop). Instead, I spent years designing websites by recreating individual elements from sites that I liked and frankensteining those elements together to create something.. respectable.

For reasons beyond my comprehension, I opened Photoshop one day and everything just clicked, and has been ever since. I can't say for sure if it's from working with so many different designs or styles, or being exposed to them, or just recognizing the styles that I preferred, but it does happen eventually.

If you're intentionally trying to learn design and you put in the time to consciously recognize what you're looking at and how it works, I bet that light bulb moment would happen much quicker.

</comment></comment><comment><USER11> It's all about metacognition. You need to look at the designed things in your life and understand WHY you like or dislike them. Look at the spacing of text, the font choices, the color choices, the contrast between fonts/colors/etc, the shape of things. Design is also how things work, not just how they look.

</comment><comment><USER12> The only necessary book on design, at only 46 pages, is "Notes on Graphic Design And Visual Communication."

I have met AIGA award designers and Internet design celebrities who don't know some of the basics laid out in this short book.

It's probably the only _handwritten_ book you'll ever read: [http://www.amazon.com/Crisp-Graphic-Design-Visual- Communicat...](http://www.amazon.com/Crisp-Graphic-Design-Visual- Communication/dp/1560520442)

</comment><comment><USER13> I have started out with Graphics Design course[1] at Berkeley Extension in SF downtown (good for people who work in the bay area).

It's once a week, I enjoy learning the very basic elements of design like understanding and using shapes.

Other than that, keep reading books and ux.stackexchange.

In my day job, I work as a software engineer.

[1]: <http://extension.berkeley.edu/spos/graphicps.html>

</comment><comment><USER14> Subscribe to dribbble's popular RSS feed. You'd be surprised how good your taste becomes just by being surrounded by it. Also, you'll start to pick up details about how they do it. You just study it at the pixel level and try to replicate in photoshop. That's the best way I've found...

</comment><comment><USER15> Here's a similar Ask HN from a few years back:

<http://news.ycombinator.com/item?id=1103578>

I recommend Before&After (a magazine and a couple of associated books)

<http://www.bamagazine.com/>

</comment><comment><USER16> Having self-taught myself a lot about design, let me give you a few pointers.

The number one rule is that you have to start paying attention to the design of everything. Don Norman's "The Design of Everyday Things" is a good start on developing this, and you really shouldn't miss it. But this applies to everything: when something's nice, figure out why. Notice typefaces, and form a mental library so you can identify them.

It's a bit of an odd path, but I'll also suggest, since you're interested in interactive systems, reading several great Human Interface Guidelines. Apple's OS X ones are my favorite (You might even want to get an older version, because they're a bit more general), but the Nokia Meego ones are worth a look too. Most others are too mediocre to teach you anything though.

Some other books I have to suggest: Bringhurtst's "The Elements of Typographic Style." Definately read some kind of lighter treatment of type first, so you know humanists from geometrics, serifs from sans, high and low contrast, and so forth, but if you want to _really_ get it, this is the book. If you go in knowing that some of what he's saying is opinion, this is the book you need to read.

The Universal Principles of Design: It's really not the best book, and there's some things, like the readability research, that's actually just complete crap, but it's an alright, quick overview of a few dozen concepts. If you understand the concepts in it, skip it, but as a first intro, you could do worse.

The Humane Interface: Other than Raskin's whining about the Canon Cat not being a hit for slightly too long, it's got some interesting concepts that all designers should understand.

Thoughtful Interaction Design: This one's very theoretical, and very heavy reading; it's really about a way to view the design process, and how it proceeds, more than it is about how to design. Don't read it until you've done a few projects.

The Visual Display of Quantitative Information: This is a great book on presenting information. Just ignore the ridiculous stuff about minimizing ink, and think of it as minimizing the cognitive load.

For a quick overview of a couple interesting concepts, you might try method.ac, reading the wikipedia pages on Fitt's Law and <http://worrydream.com/#!/MagicInk> and trolling through <http://informationarchitects.net/blog/>.

Stay away from ux.stackexchange.com, news.layervault.com, PSDtuts, et. c. It's almost all crap, about tools rather than actual designing. In general (very much in general), if a blog post on design is short, it's crap, 95% of the time.

</comment><comment><USER17> <http://littlebigdetails.com> shows some really exceptional examples of ergonomic design.

</comment><comment><USER18> Would you mind giving a link to the post about JavaScript that you mentioned? I would really appreciate that.

Thanks!

<comment><USER19> Here you go: [http://javascriptissexy.com/how-to-learn-javascript- properly...](http://javascriptissexy.com/how-to-learn-javascript-properly/)

<comment><USER18> Thank you very much! :)

<comment><AUTHOR> That post was amazing. Even the related ones he wrote on Backbone.js and Node.js are worth going through.

<comment><USER18> Exactly my thoughts! Very well written guides (tutorials?). Thanks a lot again for the link.

</comment></comment></comment></comment></comment><comment><USER20> step 1: Go through lot of tutorials in Photoshop, replicate different type of effects, patterns, actions.

step 2a: move on to Illustrator, once you start needed quality images.

or/and

step 2b: start using your html/css knowledge with your new found design skills, to start making websites

after that you are pretty much done.

<comment><USER16> I mean no offense here, but this isn't design. This is parroting visual effects.

</comment></comment><comment><USER21>
      Inoculate yourself against bad design and subscribe to Jakob Nielsen  newsletter.

</comment><comment><USER22> maybe you can check out <http://psd.tutsplus.com/>

</comment><comment><USER23> a long long time ago, i wrote a post here on hn on how to get started on web design [0], but since you already have the technical bit, you can just skip ahead to the Design part.

That said, I don't think that many "howto design" books are all that interesting (and the best design books are mystifying in a way which defies reason), but you _will_ find books about the nuts and bolts of design which are very good even if you're totally green to the field. The other most important thing is that you keep making things. Even little things. Make them and show them to people and get feedback. Lather, rinse and repeat.

Anyhow... You will want to specifically look for books on Typography, Color, Layout, Photography, Contrast/Scale, and Poster Design. Poster Design is actually sui generis despite appearing to be a subset of graphic design.[1]

My belief is strongly on the side of typography being the most crucial skill a designer needs (since its use of space/contrast/layout) is basically design in a micro level, rather than on the macro (page) level. The skills you pick up in typography _do_ translate over, but it takes lots of practice. Since illustrators are readily hopping into many design jobs, our best bet is to differentiate ourselves with our exhaustive knowledge of typography.

A great book on "Book Typography" is Cyrus Highsmith's Inside Paragraphs.

A good book on "Display Typography" is Wolfgang Weingart's My Way to Typography.

Three good books on "Typographic Fundamentals" are: Ellen Lupton's Thinking With Type, John Kane's Type Primer and Erik Spiekermann's Stop Stealing Sheep (and find out how type works).

One excellent "Typographic Reference" is Robert Bringhurst's Elements of Typographic Style.

One good book about "Design Process" is Nancy Skolos & Tom Wedell's Graphic Design Process.

No design book suggestion will be complete without mentioning Emil Ruder's Typographie, Josef Muller-Brockman's Grid Systems and Armin Hofmann's Graphic Design Manual.

 _That_ said, a good starter is layout/formmaking Christian Leborg's "Visual Grammar," part of Princeton Architectural Press' Design Briefs series[2] (all of which are good for skimming the next time you find yourself in a bookstore/amazon showroom).

Finally, I never realized it until I made a joke about it, but you can summarize many of the principles of good UI Design in PEP 20, which is to say that if you care about API Design and Code Cleanliness and all that stuff, then you probably already have the right attitude towards graphic/visual design. Take those principles and apply them visually when you make anything or use them as a rough litmus test for your designs then break the rules as you see fit.

Have fun! Relax. Don't Panic!

[0]: <http://news.ycombinator.com/item?id=1605228> [1]: While poster design employs many of the same structural techniques as Capital-D Design, it has its own rules which are useful to know, but above all it is free to play with scale in a way which is _difficult_ in web and book design. Still, knowing about it will inform your own work and probably make it wayyyy more fun. [2]: [http://papress.com/html/book.list.page.tpl?action=seriessear...](http://papress.com/html/book.list.page.tpl?action=seriessearch&__searchfield=Design%20Briefs)

</comment><comment><USER24> <http://dribbble.com>

<http://news.layervault.com></comment>


How To Not Kill Your Retention - <AUTHOR> http://lasseclausen.tumblr.com/post/56226035749/how-to-not-kill-your-retention

<comment><USER3> Definitely a very valid point that is worth reiterating! Especially true for consumer products which are older than 3 months (by then they should have learned that this is best practice) and which have lots of similar competitors (which, at least in my case, lowers the threshold of "screw it, I wanted to try this other product anyways" if something doesn't work).

<comment><AUTHOR> Yes, very few consumer products nowadays are that essential that people will struggle with hurdles like that

</comment></comment><comment><USER4> I think one part of this is dispelling the myth that telling the user which of the fields is wrong is a security flaw. You can already figure out if a username exists by trying to create it on the registration screen, so saying "Your username and password do not match" does not provide any extra security, and just frustrates users.

</comment><comment><USER5> Sorry, I'm missing the point of this submission.

The author has described anecdotal experience with login screen of some product but he hasn't actually stopped using that product. So what is this to do with user retention?

<comment><AUTHOR> The last 2 paragraphs should answer your questions...

</comment></comment><comment><USER6> In Fork the Cookbook we solved this by not having any passwords at all - <USER2> request one every time you want to login.</comment>


2012's Top five Linux stories with one big conclusion - <AUTHOR> http://www.zdnet.com/2012s-top-five-linux-stories-with-one-big-conclusion-7000009190/

<comment><USER2> So I guess the conclusion is that, rather than the Year of Linux being 2013, 2012 _was_ the Year of Linux?

Not quite the proverbial "Year of Linux Desktop", but I guess it's something.</comment>


Scientists have produced a food from electricity - <AUTHOR> http://www.delish.com/food-news/news/a54578/finnish-scientists-develop-protein-electricity/ <comment><USER2> This is two levels of blogspam removed from the original businessinsider UK article (which can't even be found via included links). The Yahoo layer at least has content:

[https://uk.news.yahoo.com/scientists-made-food- electricity-c...](https://uk.news.yahoo.com/scientists-made-food-electricity- could-011700678.html)

I don't get how a "single-cell protein" equates to "50% protein and 25% carbohydrates", though.</comment>


NoPassword - <AUTHOR> https://nopassword.alexsmolen.com/ <comment><USER3> This turns your email inbox into a giant password manager, except without the extensive storage encryption used by real password managers. Thought experiment: What are the possible unintended consequences of that?

Just a few off the top of my head:

1\. Easier for email hackers to detect sites where you have logins. (Controlling someone's email usually means controlling most/all logins, but it takes some digging to get a good list of vaulable logins. With this solution, most of the list is on the first page or two of the inbox.)

2\. Harder to detect being hacked. (Previously, a hacker with email access would have to reset your passwords, and you will notice that at least some passwords have changed. Now the hacker just has to delete any incoming authentication emails after reading them.)

3\. Losing a job becomes potentially more catastrophic. (Hope you didn't associate too many passwords with your work email, because IT wiped your account while security was escorting you out the door. And before you say only dumb people use work email for personal accounts, consider that part of the idea of this nopassword system is to help "dumb people" who fail to (for example) use password managers.)

4\. Your email provider now has a nice easily mined record of what sites you log into most often. But, hey, I'm sure we can all trust Google not to use that information in a terribly creepy manner, right?

<comment><USER4> I think a major problem would be one of the most-common use-cases: you're away from your PC, and want to access their site.

To do this, of course, you'd have to get an email sent to that machine. Then, you must login to your email on that same machine to get the PW, and thus the problem: now you have a much greater chance of leaving your email logged in on the 3rd-party machine. Whether it's a friend's laptop or a public terminal (library, airport, etc.) this is not a good thing whatsoever; all you needed to do was to login to a site to post a comment on some silly discussion board, and now you've left the keys to your kingdom in the open.

Further, if there are actual security issues with that box, say it's actively being MitM'd, keylogged, etc. well instead of simply gaining access to your silly forum account, now they will have access to your email.

I think I would flat-out refuse to use any service for these flaws.

<comment><USER5> It would be great to be able to authorize a login for another machine. I could request a login on any machine and have an email/sms sent to my smartphone and click the link there (alternatively, scan a QR code), and get authorized on the machine initiating the login.

Email/SMS would be an obvious security hole for people who just click "OK" without reading, though. I guess a QR code would be secure anyway.

</comment></comment></comment><comment><USER6> I hope that Mozilla Persona[1] (or similar) will solve this problem soon.

[1] <https://login.persona.org/>

<comment><USER7> We do, too. Please try Persona out and let us know what does and doesn't work for you. We're trying to solve this thing once, for the whole web.

Also, if you've been waiting for Persona to hit "beta" before trying it out, well, check back Thursday morning. :)

<comment><USER8> Are there any plans or thoughts in regards to adding some way to implement it on a website without using JavaScript? You control the browser, so it shouldn't be difficult to do.

For example, you could define a special URLs for login and logout actions. (E.g. persona:action=login&onsuccess=encoded_url1&onfailure=encodedurl2 ). I don't know about others, but it would make me much more willing to give a try.

</comment></comment></comment><comment><USER9> We did this on Toptranslation.com as an alternative to the normal password- based login. The thinking is, since password resets go to your e-mail, anyone who has control over your mail or mail server can get into your account anyway. It's a tradeoff between user (mostly enterprise customers') convenience and security. Since all orders made through the system require another confirmation, we decided it was worth not having to handle the "I forgot my password" support tickets. Haven't had any problems with it, I think it makes sense for low- to medium-security authentications.

<comment><USER10> There's a difference between a one-time, quickly-expiring password (requiring reset on use) being sent on email, as opposed to having the password reside there in perpetuity.

In one case the attacker needs full control during the password reset and in the other they can simply scour email for all passwords and get out - <USER2> even without controlling the account - ie, transparent proxy + poisoned DNS would do the 2nd easily.

<comment><USER11> The emails contain single-use links. Each time you login you need a new email. <http://news.ycombinator.com/item?id=4572031>

</comment></comment></comment><comment><USER12> Makes me wonder, if emails and SMS messages start to carry more and more plaintext passwords (and links) providing direct access to everything, how will their security hold up in the long run? I don't think they are inherently very secure channels.

<comment><USER13> They're not secure. SMS and e-mail are sent unauthenticated and unencrypted and can be intercepted in many different ways.

<comment><USER14> > SMS and e-mail are sent unauthenticated and unencrypted and can be > intercepted in many different ways

My SMS are encrypted with A5, and my email (gmail's inbound smtpd) is (usually) encrypted with TLS.

Of course, I always check with TLS as well.

It's not quite as bad as you seem to make it out.

<comment><USER15> I think people put way too much faith in inbound TLS. My mail server has some bozo self signed cert and nobody has ever failed to send me an email. Meaning: either nobody is using TLS to deliver mail or they use TLS and ignore all cert failures. Either way, about 99% less secure than you think it is.

<comment><USER16> Yeah; internal SMTP to SMTP traffic gives no guarantees at all. The only way is to use S-MIME or PGP.

</comment></comment></comment></comment></comment><comment><USER17> I think it is interesting that a good portion of HN users are quick to point out the security issues in a scheme like this, considering the fact that this is basically the current security model with the intermediate steps removed. The only thing that makes it different from logging in to my bank is that if I try a bank password reset I might get asked what my mother's maiden name is.

</comment><comment><USER18> I find it amusing that a page discussing passwords/security would throw a couple of SSL certificate warnings when loading it.

<comment><USER13> On top of that, the SSL server supports compression, session tickets and insecure ciphers, so that's three possible attacks to try.

What's REALLY weird: my browser is showing a different cert than OpenSSL is. My browser shows it's signed by PositiveSSL, but when I connect with 'openssl s_client' I get this:

      depth=0 C = --, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = ip-10-119-98-53, emailAddress = root@ip-10-119-98-53
      verify error:num=18:self signed certificate
      verify return:1
      depth=0 C = --, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = ip-10-119-98-53, emailAddress = root@ip-10-119-98-53
      verify error:num=10:certificate has expired
      notAfter=Feb 24 01:08:21 2012 GMT
      verify return:1
      depth=0 C = --, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = ip-10-119-98-53, emailAddress = root@ip-10-119-98-53
      notAfter=Feb 24 01:08:21 2012 GMT

Not only is it self-signed, it's expired. I actually don't know what the fuck is going on here.

<comment><USER19> The self-signed cert is from alexsmolen.com, not nopassword.alexsmolen.com.

<comment><USER13> Ah, so it's using the servername TLS extension. I forgot that some people use that now :)

</comment></comment></comment></comment><comment><USER20> So I have to log into my email to avoid logging into the site? Isn't that the exact same thing, yet now I have to include a few extra steps in between?

<comment><USER21> Anecdotally, everyone always has their email open anyway (I do, everyone I work with does, my family aways does), so the extra step of checking your email is trivial.

<comment><USER20> Unless you use a different account for junk websites than you do your day to day email. I have my work email open all day, but not my personal email, which is also different to my spam email account I use for trials or junk websites. If I need to have 3-4 different email accounts open just to manage my sessions, I could see this being a massive pain. Also if I sign up using my work email to a work related service (so I can use it at work), I might not have access to it at home.

<comment><USER22> If you use gmail, you can be logged in to multiple accounts at once.

</comment></comment></comment></comment><comment><USER4> Another glaring issue: they make the assumption that email === webmail.

While this may be mostly true, the fact is that many still use POP email, and so what, you're to setup a POP account on whatever machine just so that you can access a website? Just let me remember my simple PW, thanks.

<comment><USER23> If you're using a POP service that doesn't provide a webmail interface in 2012, something is wrong.

<comment><USER24> I run my own mail server from colocation. I have so far refused to provide webmail because I can't find an implementation that isn't a constant stream of security holes, in exactly the way that Courier / Exim aren't.

Any recommendations? I won't use PHP or MySQL on grounds of taste and decency.

<comment><USER23> > I won't use PHP or MySQL on grounds of taste and decency.

Good for you.

<http://roundcube.net/about>

<http://www.zimbra.com/>

<http://www.squirrelmail.org/>

<comment><USER4> Are you being cheeky? At least 2 of those are PHP-based...

</comment></comment></comment></comment></comment><comment><USER25> Great work implementing what was discussed here: [http://notes.xoxco.com/post/27999787765/is-it-time-for- passw...](http://notes.xoxco.com/post/27999787765/is-it-time-for-password- less-login)

For previous discussion: <http://news.ycombinator.com/item?id=4308190>

</comment><comment><USER26> Great idea. 99% of website accounts I create are only accessed once or twice to purchase something or to leave a comment or get access to something. I use KeePassX to generate passwords for most of those, but most people use passwords that are either repeated, insecure or forgotten.

<comment><USER27> Although this concept certainly has its flaws, I could see it being useful for something where it was a site that most people would rarely log in. But for a store, I'd prefer having my credit card in the hands of something more secure.

<comment><USER26> Every web store has a "reset password via email" feature, so this is no less secure. In fact it's more secure, because this way you would receive email notification every time somebody tried to log in as you.

</comment></comment></comment><comment><USER28> I use a one time password system for magicscroll.net

There's a lot of peace of mind in knowing that my users' passwords won't ever end up on pastebin but overall I regret the decision.

I get a couple of emails a week from users who don't understand how it works. If I had to do over I'd choose openID.

</comment><comment><USER27> This is an interestimg idea and surely has it's place, but how you implement it is critical. For example, you would want SSL for the entire site to ensure the cookie is always protected. You would also need to make sure that the token and session management is solid.

Of course to really make it secure, you would want all smtp connections between you and the user to use SSL, which you cannot guarantee. One test I always use for new authentication schemes is would the NSA be able to compromise your account if they wanted? In this case I would definitely say yes.

Still, this would be excellent for sites that only have you login to set preferences, etc.

</comment><comment><USER29> My bank starting texting me a one-time password which at first I thought was weird - but now I like it better than actually having to create and save a password. Seems like a nice natural extension of this for more secure things.

<comment><USER30> As some will point out, SMS is generally insecure because of the possibility of snooping vulnerabilities.

An even more secure way to implement one-time passwords is through an HTOP[1] smartphone app. The crypto is seeded once and then never has to communicate over the network to generate an OTP. Only the person with physical access to your phone can generate a password. I know when I was with USAA, they allowed you to generate one-time passwords using this method.

[1] [http://en.wikipedia.org/wiki/Time-based_One- time_Password_Al...](http://en.wikipedia.org/wiki/Time-based_One- time_Password_Algorithm)

<comment><USER29> The concern is that in the 2 seconds it takes me to type the password in someone will intercept it and beat me to it? This is way safer than email.

<comment><USER30> I don't understand why you downvoted me -- my point is perfectly valid.

"The concern is that in the 2 seconds it takes me to type the password in someone will intercept it and beat me to it?"

The concern is that someone will snoop the password before it even gets to your phone. SMS snooping/MiTM has been demonstrated before [1]. Time-Based One-time Password algorithms are safer because they are not vulnerable to the aforementioned probems -- they never touch the network.

"This is way safer than email."

I never said it wasn't?

[1] <http://en.wikipedia.org/wiki/IMSI-catcher>

<comment><USER29> I didn't down vote you.

</comment></comment></comment></comment></comment><comment><USER31> This is really great. There's quite a few places where I'd love to sign-in like this.

The one area where I think it would fall down is logging into web apps that have multiple points-of-entry. Such as chartbeat(phone app and website). I don't see how you would be sent a link to log into an iPhone app. Or could you be sent and email with multiple links: one that goes to the site, another that flings you into an app?

The best implementation would be if web apps offered this in the preferences area with a check-box saying: "Enable NoPassword" (so you don't offend any traditional password lovers or confuse people that just might not understand it).

</comment><comment><USER32> For none critical information and just a mean to identify a user account, this is a good idea.

In such system, The weakest link is the mail system, but this is not worst than what is done today. Replace mail by an sms code or whatever equivalent.

</comment><comment><USER33> Bad solution, email is slow and unsecure. I also have always hated identities linked to email in anyway. It's wrong way and that's it. Also allowing password recovery via email is dangerous, because email isn't secure either. Email is secure if you use GPG, and in that case it would be better to login by signing nonce with your private key and returning signature to site, which can verify it against your public key.

</comment><comment><USER34> This is a neat idea. There are plenty of sites that I only use once or twice a year, or ever. I'm not sure how widely this will be adopted, though, since most sites tend to cater to the people that access them frequently.

Also, as a user, you can accomplish this same thing by just using a common username across all your 1-off sites, along with a gibberish password that you reset every time you want to log in.

</comment><comment><USER35> When I'm on an untrusted computer, e.g. in an internet cafe, I typically try to avoid logging into webmail. E.g. I'll first put files I want to print into Dropbox and then log into that instead, (the consequences of an attacker getting access to my Dropbox are less grave than an attacker accessing my email account). This extra precaution is not possible with this NoPassword scheme.

<comment><USER36> _The consequences of an attacker getting access to my Dropbox are less grave than an attacker accessing my email account._

Can you be specific as to why? If you use Dropbox for personal information, I'd assume it would be similar.

<comment><USER37> Once someone has access to your e-mail, they can reset your password and log into anything that you used that e-mail to sign up for. With Dropbox, all they'd have access to is whatever files you happen to have in your Dropbox at the time.

</comment></comment></comment><comment><USER38> I like it. Especially because theoretically it can be mixed with other, conventional authentication schemes, so it can be made completely optional and used at will, just like sites currently mix password + several OAuth providers.

It's pretty much the ideal scheme for all those sites you don't visit regularly (and many of us, despite knowing better, use the same password for...).

<comment><USER39> Definitely a neat idea. Could also just email them a reusable link except that would leave the credentials in your browser's history unless there is a way to avoid that.

<comment><USER40> _Terrible_ idea. A reusable link is as bad as emailing a plaintext password and not requiring a reset afterward.

</comment></comment></comment><comment><USER41> Wouldn't it just make life easier for all of us to use auth via apps? I know that right now different providers use different layers of shit for their own purpose but there's gotta be a common ground for all of them that we could leverage for the sake of getting passwords out of the game for the most part of it.

</comment><comment><USER42> Interesting. you're basically sort of taking the password part out of two- factor authentication.

(I know its not _exactly_ that)

</comment><comment><USER43> I keep asking users about this login process and passphrase instead of password. Most users seem to feel suspicious of the email login because most users have already been trained to not entirely trust their email. I don't think that this could become an accepted authentication method simply because of that

<comment><USER11> Regardless of whether this will be accepted, users need to be retrained. Any site that offers a password reset via email _already_ effectively lets you login via email. Users should be aware of this so they can be more careful with their email (picking a decent password, ensuring they logout on public computers, etc).

IMHO everyone should be using two-factor authentication for their email.

</comment></comment><comment><USER44> Hasn't craigslist been doing this for awhile now? For those worried about the hassle/security of checking email to sign in to a website, there could just be two methods of login. One is the proposed NoPassword, other is the traditional username/password, and leave it up to the user to choose.

</comment><comment><USER45> The user experience is so different, I think using it would push users away from the different experience.

</comment><comment><USER46> The idea is nice, but I see a couple of problem with that kind of implementation:

1) You don't have/won't access your email account on that computer (ex: Internet Cafe)

2) Spam filters that may delay the mail and so will delay the ability to log in. (ex: Grey Listing)

3) Changing your email account (ex: Work Email to personal email)

<comment><USER47> The thing is when I used internet cafes, the first thing I would always open would be email.

2 and 3 and really valid though.

<comment><USER48> "The thing is when I used internet cafes, the first thing I would always open would be email."

Seriously? Intenet cafes are the least secure computers to give your email and password to. Sure for junk and spam-email accounts, that you dont care about anyway. But logging in to your personal email account on an internet caffe!? Thats madness.

</comment></comment></comment><comment><USER49> Doesn't this need some kind of browser plugin to set your cookies with? Most websites don't have secret token URLs that will log you in, right? What about sites that issue cookies per-IP? Maybe I'm misunderstanding the mechanism here, would love clarification.

<comment><USER13> You put an e-mail in the box, click Submit, it sends you an e-mail with a link to click. You click the link, it brings you to a page that sets a cookie for you (key '_logged_in', value 'SOMEKEYSPECIFICTOYOUREMAILADDRESS'). Browse the site with the temporary key linked to your e-mail address. When your browser closes the cookie is gone.

If you want to log in again, repeat the process.

Now, here's why this is a bad idea: e-mails are not secure. They are sent willy-nilly around the internet in plain text through multiple mail relays. All one would need is to sniff traffic on a network segment that the mail travels over and you'd have a hell of an easy time collecting login info. This is why the passwords sent over e-mail are supposed to be _temporary_ , and why most good password reset forms ask for additional confirmation details before they let you reset the password.

You might think the above process would be secure if the link they send you is de-activated the first time you click it, but anyone could just keep sending more e-mail login requests and collecting the e-mails. The whole thing is pretty not-secure.

</comment></comment><comment><USER50> It's great to have a library for this ... I first encountered a service using this type of login with www.wasitup.com (sadly now down) in 2010 and never had an issue with logging in, though it was indeed necessary to open an e-mail when using a new computer.

Thanks!

</comment><comment><USER51> There are security issues with this approach. However, I wouldn't mind if a site offers both traditional login and email based login. Then, I, as a user can choose which is the most appropriate.

</comment><comment><USER52> You need a password to get into your email account. \+ You have to open your email account every time you need to login into the website, it's a bad user experience.

\+ What if you lose your email account password?

<comment><USER53> Most people have their email open, not only on their desktop but also on their mobile devices. Most importantly, you'd only do this once per device, unless you need to log out or clear your cookies.

If you lose you email account password, you'd need to follow the email service provider recovery process. Gmail, Hotmail, etc. have significant resources dedicated to helping people with this.

</comment></comment><comment><USER54> This is how hi-games.net has worked for years, and it's a clever implementation, but I wouldn't want my bank to use it until we replace email with something, you know, secure.

</comment><comment><USER55> One big problem with this approach: what happens when your email is down? Does a website really want to tie its availability to that of Gmail / other web mail services?

</comment><comment><USER56> Another similar application but to you mobile instead. Acts like a physical key. <http://launchkey.co/>

</comment><comment><USER47> It would be interesting if you could integrate a mail handler to this service so that you could simply email them to request a session.

</comment><comment><USER57> > We're sorry, but something went wrong.

</comment><comment><USER58> Now, cue the browser plugin to which you give access to your gmail (via OAuth), that handles this transparently.

</comment><comment><USER59> Among other problems, have to put up with delays imposed by greylisting, if your email server does that.

</comment><comment><USER60> So I have to check my emails _every_ time I want to connect to your website? Seriously?

<comment><USER53> From my blog post:

"Yes, logging in by waiting for an email and clicking a link does take longer than entering a password. But you should only have to do this once per device. Unless you're constantly letting other people use your computers (and logging out of your email client each time), you're golden."

<http://alexsmolen.com/blog/?p=194>

</comment></comment><comment><USER61> I'm actually using this _strategy_ more often than I would like to admit.

</comment><comment><USER62> Alex, It´s giving me an error: We're sorry, but something went wrong.

</comment><comment><USER63> Combine this with google authenticator for 2 step auth?

</comment><comment><USER64> " We're sorry, but something went wrong. " :(

</comment><comment><USER65> How do I run an webmail service with this?

</comment><comment><USER66> This works well for mobile.

</comment><comment><USER67> still annoying. i prefer browserid: zillion emails, one password =p

or password managers

</comment><comment><USER68> railscasts also uses an email link for a login

</comment><comment><USER69> what's wrong with OpenID again?

<comment><USER70> Regular people don't get it.

<comment><USER69> Seems to work okay on Stackexchange. Even the English and Home-Brewing versions!

<comment><USER70> Oh, when you said OpenID, I assumed you meant the UX concept (the idea of logging in with an URL). since that was the level being discussed here. SE does use OpenID, but it's essentially just a backend technology, which is irrelevant to the user; they can login with an integrated third-party service (Google, FB, etc) or even with a password (by choosing the SE provider).

</comment></comment></comment></comment><comment><USER71> We're sorry, but something went wrong.

</comment><comment><USER72> This technique hits the front page once every other week. With the same flaws. Use BrowserID. It's better than this and it paves the future towards actually being able to truly transition away from passwords.

<comment><USER73> You mean Mozilla Persona? :)

<comment><USER72> Well BrowserID is the protocol, Persona is Mozilla's implementation. You can use BrowserID without using Persona.

</comment></comment></comment><comment><USER74> Y u no use LastPass? I've been using it for more than a year and never had a problem. Today, I only know 3 passwords, one for each of these: LastPass, full disk encryption in my PC, and the login in my PC.

<comment><USER26> You use LastPass, but 99% of the web doesn't. This proposal makes a web site both easier to use for those users, and more secure.

<comment><USER74> Yes your proposal is good, I was talking to the commenters, sorry.

</comment></comment></comment><comment><USER75> This is dumb idea and requires that you open your email to login to a site that you want to use. Faster is just typing your username and password and pressing the login button. Anyway browsers make this even faster by storing the username and password.

<comment><USER76> Also you are kind of putting all your eggs in one basket...

<comment><USER75> Sorry, but I do not see anything bad at saying "this is dumb idea" different would have been if I had said "This is fucking stupid idea". Anyway my negative points kinda were earned. :(</comment></comment></comment>


Ask HN: Our old LaunchRock page was terrible, is this one any better? - <AUTHOR> http://signup.happynerdshirts.com

<comment><USER2> You can try Strikingly.com. We have a lot of customers using Strikingly for landing pages. Here are few examples:

<http://www.kipsolutions.co> <http://www.disdo.com> <http://www.noq.io></comment>


Russians buy Yahoo! - <AUTHOR> http://www.bloomberg.com/news/2011-10-03/silver-lake-discussing-yahoo-with-alibaba-digital-sky.html

<comment><USER2> Headline is patently false in at least two ways.</comment>


Why Are So Many BASE Jumpers Dying? - <AUTHOR> http://www.nationalgeographic.com/adventure/activities/aerial-sports/why-are-so-many-base-jumpers-dying/ <comment><USER2> This surely has to be one of the most SMH-inducing article titles ever.</comment>


Ask HN: Is there some database/shop for recipes and pictures of the results? - <AUTHOR> I'm working on an application related to food. I guess I could scrape one of the billion food websites but I would like to make it legit.<p>So what I need is recipes with related images for purchase. Where would I be able to get this? <comment><USER2> [http://developer.pearson.com/apis/pearson-kitchen- manager/](http://developer.pearson.com/apis/pearson-kitchen-manager/)

<comment><AUTHOR> Thanks! Looks great.</comment></comment>


Indian police to use 'pepper-spray drones' on protesters - <AUTHOR> http://www.telegraph.co.uk/news/worldnews/asia/india/11521639/Indian-police-to-use-pepper-spray-drones-on-protesters.html

<comment><USER2> Somehow I see this creating blowback. The frustration from an impersonal punishment could result in splintering of an angry mob into those deterred, and those now determined to strike at the heart of those impersonal operators.</comment>


The party's over for American consumers - <AUTHOR> http://seattletimes.nwsource.com/html/opinion/2003879888_harrop12.html

<comment><USER2> Growth in productivity is just about the only number you need to track on a national scale. On the long term, it is by far the best indicator of increasing wealth.

So I pay little attention to numbers like consumer confidence.

</comment><comment><USER3> This is important because people change there focus on purchases from luxury extras to necessities. Developing productivity applications that can help someone in a particular industry make more money, I believe is where people will be willing to spend even when credit is contracting (which is happening now).

<comment><USER4> Ever ask yourself, "Why would anyone pay that much for THAT?" Pretty soon, they won't. If you can provide an offering that makes more fiscal sense to consumers or small business people, you may find fertile fields. I can just hear them now, "I hated paying those $ _#_ @^! Now I can use <insert your company name> Web service instead."

</comment></comment><comment> patrickg-zill 1\. Not according to the cars I see in the parking lot and the long lines at Outback and every other steakhouse or upscale pasta palace in my area.

2\. Christmas shopping season is coming, people will still act like idiots on the day after Thanksgiving when WalMart sells PS3s for $5 apiece or whatever.

3\. Wall Street is desperately trying to play the media for suckers and make it sound like a bailout is needed. Remember a lowering of the rate or other steps taken to help ease the mortgage crunch, only helps those buying the mortgages - it doesn't help the person who is paying the actual mortage: they are on the hook regardless.

</comment><comment><USER5> What would be the best way to benefit from this (other than shorting stocks)?

Am I correct in thinking that all the stocks will be hit? (impact differing only in magnitude, not in direction).

Are you guys doing anything about this, like buy Euros etc?

<comment><USER6> Of course, big money is _only_ to be made in volatile markets. In a stable, efficient market, people buy value stocks and make money from the dividends. So, you might think that "Well, I predict bad times, so I should short the market..." But that's not the case in inflationary times:

<http://www.mises.org/story/2532>

The best strategy seems to be:

1) Go where the money _will_ flow, and go where the future is _young_. This means Asia for the most part. Europe is almost as effed up as the United States, but with smaller defense expenditures.

2) Guard against inflation. You can do this by buying other currencies, gold, or by buying futures on margin, etc.

<comment><USER5> 1) Won't a U.S. crash take everything down with it? 2) Thanks.

Shorting is scary for me due to potentially infinite risk. Is there some other way of doing pretty much the same thing (making money off of declining stocks) without losing more money than you lay on the table?

</comment></comment></comment><comment><USER7> Oh no! No more cheap plastic crap from china!!! What are we going to do??? OMG we'll have to make it ourselves!!!!!!!!

<comment><USER2> The same people that worry about trade from china tend to claim that it is cheap and worthless.

Think for a moment about that, and you'll realize neither make sense.

People want it, so it isn't worthless. They make it with a competitive advantage. I'd prefer to live in a country whose competitive advantage was in designing products, not manufacturing them. It's obviously higher value.

<comment><USER7> I'm just saying there's no reason to panic. There is is an upside as well as a downside to this whole devaluation thing. People on the right AND left have been complaining about the loss of manufacturing jobs for years -- well, now they can have them again -- if that's what they want. I personally wouldn't enjoy working on an assembly line. Hell I don't really like working at all.</comment></comment></comment>


Google Public DNS - <AUTHOR> http://code.google.com/speed/public-dns/ <comment><USER2> One of the problems with using 'public' DNS servers like Google and OpenDNS is that content delivery networks return the IPs of their nodes that are closest to your DNS servers based on the assumption that you are on the same network as your DNS servers.

I just did a comparison and I am 10ms away from the Akamai node returned by my ISP's DNS servers, 88ms away from the node returned by Google Public DNS, and 20ms away from the node returned by OpenDNS. Even if DNS is faster, it may make everything else slower...

<comment><USER3> That may be true...

but I am willing to _sacrifice a few hundred ms_ to avoid the several seconds of frustration when typing 'gmail' into the firefox address bar gets me __redirected to some stupid ass ISP specific SERPs page __=D

<comment><USER4> Do you have any idea how confused I was the first time that happened? An absolutely terrible user experience.

</comment></comment></comment><comment><USER5> Phone support!

      Google Public DNS telephone support
      877-590-4367 in the U.S.
      770-200-1201 outside the U.S.

I wonder if this will be a trend.

<comment><USER6> Just an automated dude telling you what you already know or can find easily on the web. You can't reach a human at that number, at least for now.

</comment></comment><comment><USER7> More data mining by google under the guise of global awesomeness.

The point most people miss is that all of your habits and information are under one roof and only need one subpoena to get your entire electronic life on DVD. This just adds to what they already know about your searching, emailing , communicating and spending.

<comment><USER8> Yea, because your ISP totally wouldn't do the same thing.

<comment><USER9> I suppose the ISP can do that anyway, no matter what you do. Even if you use Google DNS, your ISP can still know where you surf to.

</comment></comment></comment><comment><USER10> It's an interesting idea, but based on some early tests it looks like a losing bet to me.

My ping from a dedicated 15mb Qwest circuit to 126.96.36.199 and 220.127.116.11 is between 57ms and 75ms. However, cached DNS resolutions run at around 12ms from our default DNS servers. Even uncached resolutions are still way faster than the round-trip to Google.

Google Public DNS might be worth it if every single one of your DNS queries would result in a cache miss, but otherwise I don't see the performance improvement Google is gunning for.

That said, it is nice to have a public option.

<comment><USER11> That's funny. I'm with Rogers in Canada, and their DNS requests can take 2000 ms on a normal day.

<comment><USER12> That's not funny.

</comment></comment></comment><comment><USER13> In addition to speeding up the internet for everyone, there's a specific benefit to google: <http://code.google.com/speed/public-dns/privacy.html>

They can crunch the data on queries and infer which sites are popular (and in what geographic regions they're popular).

</comment><comment><USER14> I tested this and it is consistently offering better results than OpenDNS and 220.127.116.11. The results are here [http://www.manu-j.com/blog/opendns-alternative- google-dns-ro...](http://www.manu-j.com/blog/opendns-alternative-google-dns- rocks/403/)

How are the results from inside US ?

<comment><USER15> They are better than 126.96.36.199 in USA.

</comment></comment><comment><USER13> Neat. They even got memorable IP addresses.

</comment><comment><USER16> OpenDNS on GoogleDNS is worth a read:

<http://blog.opendns.com/2009/12/03/opendns-google-dns/>

</comment><comment><USER17> I always hated the redirection my ISP's DNS and OpenDNS forces. Every time I make a typo, i have to completely retype the URL because they redirect me...

<comment><USER18> I've used OpenDNS since they became publicly known and have never gotten a redirect that I can remember. Did I configure that somehow?

<comment><USER19> Try a typo or a completely incorrect domain name.

</comment></comment></comment><comment><USER20> Now Google can make cash off typo domains by turning it into a Google search and hopefully earning some sponsor link clicks. Not a bad idea. I wonder if they are going to record requested URLs so they know which ones have high traffic to spider more often... I can see a lot of reasons why Google would want to offer this.

<comment><USER21> More like record every URL you visit, and use the content of those websites to determine intent, and then target ads accordingly.

<comment><USER22> Eh, I don't know if they'll be able to do that too effectively because of NAT and whatnot, but they can certainly use this information in their PageRank calculation. Knowing what pages people visit is an even bigger vote of confidence for the site than seeing how many pages link to it.

<comment><USER21> Assume you are logged in or you have a gmail cookie, hell yeah they know.

<comment><USER23> You're aware that HTTP cookies are not sent to DNS servers, yes?

<comment><USER21> Yes. I meant if you're not behind a NAT they can correlate your IP with your gmail cookie when you do a search and thereby link a record of the sites you are visiting to your profile to serve you more targeted ads. Apologies for the ambiguity.

</comment></comment></comment></comment></comment></comment><comment><USER24> Next up: Google Public ISP

(vertical integration)</comment>


Ask HN: My phone has stopped receiving updates. Should I be worried? - <AUTHOR> Should I be worried about my phone isn't receiving any kind of updates from the manufacturer anymore?
I have myself an Google Nexus 6P that recently was declared end-of-life. I know that I will miss out new features that future Android versions will provide, but for me that's okay, but why should my device be excluded from security or nasty bug fixes. I still have weird bug that randomly make my phones completely silent. No alarms, no notification sound, no ringtone; I have been late for work a few times (and yes, I have tried to factory reset my phone couples of times).
Nowadays it seems that average lifespan for a phone is about 2-3 years, which have negative effects on environment, as people are forced to change phones.
Why not let people use their phones longer, let say 5 years (or even longer)? The manufacturer can still sell new models, but should provide and updated operating system much like what's is done on a computer. And if I'm not wrong, doesn't Apple provide longer lifetime for their iOS devices?
Why are we forced to this commercial behavior and what can the average user do to minimize environmental impact? <comment><USER2> First, the reasons for this situation:

Microsoft does not allow PC makers to modify Windows. This is why Microsoft is able to push software updates directly to all Windows PCs. Phone makers are allowed to change Android willy-nilly. This means that the OEM has to check each update and manually integrate it with their version of Android before it can be released. There's no way to keep getting system updates to an Android phone without the manufacturer paying someone to integrate those changes.

Why can't the manufacturers just open source their changes and let the community produce updates? Two reasons:

One, the manufacturers like to add "improvements" to Android, and live under the delusion that people base their phone purchasing decisions on these extra features. If they opened them up, a competitor could copy them, and the original manufacturer would lose their "competitive advantage".

Two, the carriers are obsessive about controlling everything. They don't want phones running custom firmware on their networks, and they pressure the manufacturers to prevent that from happening.

What can you do? Not a whole lot.

If you want regular updates on exactly how big of a risk you are taking, you can follow Google's security bulletins here: [https://source.android.com/security/bulletin](https://source.android.com/security/bulletin)

Otherwise, my procedure would be to treat the phone like it's the bad old days of Internet Explorer 4.x all over again. Assume that any website you visit or attachment that you open can infect you with a virus. Assume that any financial information and any passwords can be intercepted by malware installed on the phone.

Specifically: Limit web browsing on the phone to a handful of sites that you trust. Avoid opening attachments to emails or texts. Do not do any online shopping or online banking on the phone. Avoid logging into any online account you can't afford to have broken into.

This is probably overkill, but back in the day the Stagefright vulnerability made it possible for any website to install software on an unpatched device. Unless you're willing to invest time into confirming that a similar vulnerability does not exist in your current system, the best option is to just assume that there is one.

<comment><AUTHOR> > Microsoft does not allow PC makers to modify Windows. This is why Microsoft > is able to push software updates directly to all Windows PCs. Phone makers > are allowed to change Android willy-nilly. This means that the OEM has to > check each update and manually integrate it with their version of Android > before it can be released. There's no way to keep getting system updates to > an Android phone without the manufacturer paying someone to integrate those > changes.

Yeah, pushing proprietary software make sense, as this enables Microsoft to have total control over their OS. But wasn't the goal with Project Treble to make it easier for manufactures to update their software? But on the other hand they want to sell devices, not maintaining old ones.

> Two, the carriers are obsessive about controlling everything. They don't > want phones running custom firmware on their networks, and they pressure the > manufacturers to prevent that from happening.

But, why? What are their gains?

> If you want regular updates on exactly how big of a risk you are taking, you > can follow Google's security bulletins here: > [https://source.android.com/security/bulletin](https://source.android.com/security/bulletin)

It's kind of scary to look at this when handling a abandoned device and even more scarier when you realize that they are things that isn't listed here, like 0-day exploits.

> This is probably overkill, but back in the day the Stagefright vulnerability > made it possible for any website to install software on an unpatched device. > Unless you're willing to invest time into confirming that a similar > vulnerability does not exist in your current system, the best option is to > just assume that there is one.

Yep, and this is the reason why you shouldn't use outdated device as daily driver.

</comment></comment><comment><USER3> Eventually you will probably want to root it and install LineageOS (or some other ROM).

[https://www.androidpit.com/best-custom-roms-for- android](https://www.androidpit.com/best-custom-roms-for-android)

I have it installed on an old Nexus 5.

<comment><USER4> +1 I installed lineages on my HTC one m8, felt like I got a new phone and I am happy enough to continue using my phone which I purchased in 2014.

I am interested in the librem 5 by purism but am still hesitating spending $600 on what I think is a risky investment...

</comment></comment><comment><USER5> Is it rooted? That would stop OTA updates.

<comment><AUTHOR> No, factory image.</comment></comment>


What skill is best to master: Web, Android or iOS? - <AUTHOR> My company recently shifted me from a web developer role into an iOS development role (the whole mobile first thing). However, Android market share is growing fast. Am I investing my time in learning the right technology? <comment><USER2> Learn the Why behind Best Practices for your current platform so you can switch between them more easily.

To actually respond to your question, kick ass at iOS and you'll have two of three. Slack at iOS and dabble at android and you'll have one of three.

</comment><comment><USER3> Learn to build great native iOS apps since that's your current job. That'll give you the best results. It takes more work than you think to master something. At some point, if you get involved with Android learn native there too.

</comment><comment><USER4> If you master iOS, I'm pretty sure you'll be able to shift to Android fairly easily.

I'm doing the Coursera course on Android, and it's been pretty effective so far:

[https://class.coursera.org/android-002](https://class.coursera.org/android-002)

Just try to keep up with the headlines on web development (and/or try to do some pet projects to try them), and you'll probably be able to catch up if you need to shift back.

</comment><comment><USER5> I'd have to say web development. When I say that I mean these skills specifically:

SQL (I recommend PostgreSQL), one of Python/Ruby/Scala, HTML5, JavaScript, CSS, and one of the popular JS front end client libraries, like Ember or AngularJS.

I'm working on that skillset myself right now, having already learned android development and at least given iOS a spin.

As for Android, be prepared to have the Dev team changing the damn API all the time.

For iOS, you're gonna pay up front just for the privilege to develop.

For both Android and iOS, you're looking at using a monolithic app store as your primary distribution mechanism for whatever software you write and being cheifly at the mercy of Google and Apple. Sure, there's other app stores... They're not enough to put dinner on the table.

If you're especially looking to be able to develop your own MVPs and launch something, just learn the web side yourself, develop that, make an API, and expose it. If your app is good enough people will just write mobile clients for it and they'll sell them on the app stores...

</comment><comment><USER6> Disclaimer : I am an Android developer

The way I see it : nobody knows which technology is going to be prevalent in 5 years. Android and iOS are now the two mobile platforms of choice and I don't see any of these two weaken significantly in the near term.

They have both kinda the same downside : -Nobody uses obj-C / Swift outside of Apple bubble. -Android is pretty much the only place where Java is not boring. Some net giants like Google also do very interesting things with it server side, but outside of these 2 cases, Java is a used to make mediocre software.

I don't think it should be up to your employer to decide for you which technology you should learn, but that's between you and him.

As far as I can tell, neither iOS, nor Android is a bad choice. in the mid/long term, you might want to have a look at the new cools kids on the block, Rust, Dart and Go.

</comment><comment><USER7> Learn Web. Stuff like Cordova/Phonegap, Titanium and others already enable you to build mobile apps for like 95% of all usecases with web technologies.

If you do Meteor.js, you build cross platform apps web/android/ios with ease today.

</comment><comment><USER8> Compared to iOS and Web developers, there are fewer Android developers that really grok what Android can do. Of the widely used application platforms, Android is the most interesting technologically.

</comment><comment><USER9> Web is always a sure bet.</comment>


Yahoo, Bucking Industry, Scans Emails for Data to Sell Advertisers - <AUTHOR> https://www.wsj.com/articles/yahoo-bucking-industry-scans-emails-for-data-to-sell-advertisers-1535466959 <comment><USER2> From the article - Rob Griffin, chief technology officer of digital-ad consultancy Tovo Labs, "is how do you monetize it without the icky factor?"

Uhhhhh how about don't read emails? If I have a fantasy football team, please sell me football stuff. If I click on an article relating to health concerns, sell me organic whole foods stuff.

Can you imagine someone 20 years ago throwing all your mail into a scanner and saying, "don't worry I'm only checking for keywords and receipts"?

<comment><USER3> This is the thing I find really weird about online advertising. Every other medium has ads based on the content or demographic that most likely reads that content. Those ads are always contextually relevant, sufficiently diverse (rarely will you see the same ad repeated everywhere) and few people find them invasive. Online, however, ads are tailored to you as a person. They chase you around the web, even for products you already decided you didn't want, and are always vaguely creepy. Why is it that way? Is it really more profitable, or is personalized advertising google's long con?

<comment><USER4> Did you know that most Google ads have a button you can click in order to tell Google that you don't want to see the ad again. Even advertising videos on YouTube have this option. You can tell them when an advert is not relevant or you've seen it too many times. Oddly Google doesn't publicise this much even though its probably a feature which improves their profitability.

<comment><USER5> Do you realize that is tangential to the discussion? They shouldn't be invading privacy in the first place!

And what do you mean not publicizing it? It is quite visible on the ads they show it for.

</comment></comment></comment></comment><comment><USER6> This is a big business for hedge funds too, not just advertisers. Every Uber receipt, every Amazon purchase, every receipt that hits your email inbox. Aggregated and tracked at the product SKU level. That is pure gold for investment research. Few sources of data can match what email inboxes provide.

E.g. Superfly Insights [1], Return Path [2]

[1] [https://alternativedata.org/data_provider/superfly- insights/](https://alternativedata.org/data_provider/superfly-insights/)

[2] [https://returnpath.com/downloads/know-email- data/](https://returnpath.com/downloads/know-email-data/)

<comment><USER7> This is why Amazon no longer lists all of your purchases in your email receipt. It just says "your order of XXX and N more items".

<comment><USER8> Huh. I guess Facebook's move away from including someone's update or message in their notification emails had to do with more than getting you to go to their site...

<comment><USER9> Facebook still does notification emails?

I've been filtering them straight into the trash for the best part of a decade. It seems so backwards to send them when most people check their Facebook more often than their email.

<comment><USER10> > I've been filtering them straight into the trash for the best part of a > decade.

Why not just turn them off? I haven't received a single notification email from then in years

<comment><USER9> Maybe I have, I'm not sure. Whatever I did to stop my inbox being flooded with emails from Facebook, I did almost a decade ago and I haven't touched it since.

<comment><USER11> Probably filtering them. Before I deleted my FB I remember it being a struggle to not have my inbox flooded. I would disable all the notifications and every few months when they updated their policies or changed the site those notifications would helpfully get turned back on.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Try deleting your Yahoo account. It doesn't work. They say they delete your account but then it wills till be there getting emails. It's impossible to delete your account.

<comment><USER13> Honest question: is it better to delete the account or leave it as a placeholder to prevent the name being taken by someone else? I have an ancient yahoo address that gets a lot of spam and a few newsletters, but I'm 99% sure that there are some website credentials out there that still use the address and dozens of contacts who still have it their address book.

I started to (try to) delete the account several times and always hesitated out of fear. And when I ask myself "what's the harm in leaving it there?" I can't really come up with a good answer.

Also interesting aside, Yahoo/Oath nag me every couple weeks to agree to the new Verizon draconian privacy forfeiture terms. I wonder if they'll eventually block logins and cutoff email forwarding if I never click through. My cynical hunch is that they'll equate logins with consent after updating the TOS to explain this.

<comment><USER14> It is risk averse to keep it and functionally useless. Yahoo recycles unused handlrs after a timeout of a few years and scammers find these and still all accounts associated with them.

Usecase: friend dies, years later some turkey kid stole his facebook bv his login was yahoo email based and BOOM has access to a lot of social media data.

</comment></comment></comment><comment><USER15> Does anyone still use yahoo for email? It's a place where spam goes to die.

<comment><USER16> Oath (Yahoo) doesn't even use Yahoo Mail. We're all on GApps.

<comment><USER17> What exactly is Verizon's plan with your company if I may ask? Are they just looking to make money off of existing customers and the few good products they have, or are they going to try and make a move to become a serious silicon valley competitor?

<comment><USER16> I can't say what Verizon's plans on for sure, they are pretty hands off from what I can tell.

Oath's goal is to be the premier "AdTech" company. According to leadership we're only behind Google and FB. But the division I work in doesn't touch ads so I'm not the best person to talk to.

<comment><USER17> Hmm that's pretty interesting. Makes sense that they are trying to get in on the ad game, but I would expect them to rebrand to get the revenue on the search/mail ads and such since Yahoo has the infrastructure already for it.

I assume that if Verizon is being hands off Yahoo must be doing decently well. Otherwise I'd imagine they would be trying to move it in a new direction.

<comment><USER18> Verizon was fairly hands off with aol as well when I worked there. I think they just don't know what the fuck to do with those companies now that they bought them, to be honest.

<comment><USER16> When the company I work for was bought out by Verizon they gave it to AOL for that reason.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Doesn't gmail scan your mail for data to target ads?

<comment><USER20> In the past. We (I worked on gmail ads during this time) stopped doing it about a year ago.

[https://blog.google/products/gmail/g-suite-gains-traction- in...](https://blog.google/products/gmail/g-suite-gains-traction-in-the- enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/)

<comment><USER21> Thats good, but something tells me I still shouldn't fully trust Google/Gmail with things like this.

<comment><USER22> You shouldn't trust anyone. There's nothing stopping them from doing it again, or continuing to do it and publishing that nice writeup. Of course when your data is on a 3rd party server, that 3rd party has access to it. Why do we keep pretending like anything else is the case?

<comment><USER23> > Of course when your data is on a 3rd party server, that 3rd party has access > to it.

You realize that oblivious third-party storage can exist, right? For example, Tarsnap. It's the the durable-storage equivalent of end-to-end encrypted messaging. The client does all the encrypting; and the client is open-source; so you don't have to trust the third-party at all.

This is a bit more challenging when you want clients to be able to operate over an index of the data, rather than just the raw data (i.e. you want them to be able to search through their stored email)—but it's fully possible to architect a service such that all indexing happens on the client (perhaps distributed between many connected clients in the case of a shared data-source like a Slack workspace), where the backend is just obliviously storing and returning E2E-encrypted copies of generated index chunks, in the same way it obliviously stores and returns E2E-encrypted copies of the data itself.

</comment></comment></comment></comment></comment><comment><USER24> No great surprise. The only people still using Yahoo aren't very tech savvy and don't know about the data breach, plaintext passwords, etc.. My guess is Yahoo can get away with this and they know it.

</comment><comment><USER25> It's just a matter of time until all companies that sit on a ton of data start using it to make money. There is just no way around it unless they are being forced by law not to do it.

<comment><USER26> it's not just a matter of time. As stated in the article, Google actually _reverted_ its policy on the issue and has since stopped collecting data from user email content.

There's nothing inevitable about this. Even apart from law employees can steer the direction of companies, especially in tech where businesses are so dependent on a relatively small number of them. If you think privacy practises at your place of work are bad, bring it up.

<comment><USER13> Are you suggesting that Google took a stand on principle and voluntarily gave up gathering more data on users of its free services out of respect for privacy?

Or is it perhaps more likely that Google gets enough info from users via others means that it simply wasn't getting enough value out of email scanning? Or maybe starting a trend against email scanning hurts competitors more than it hurts themselves?

<comment><USER26> It is probably all of those things at the same time, and nothing stops employees from wielding considerable power when it comes to influencing decision making on any of those issues.

Google was, only a few months ago, forced by its employees to turn down lucrative defence contracts, and has since committed to not participate in them.

I think if employees manage to accomplish that we can all manage to improve our privacy practises.

<comment><USER13> I tend to agree, fwiw. Scanning emails prevented Google from taking a stand on privacy without subjecting itself to easy potshots of hypocrisy, regardless of how many times they explained the methodology and use of keywords instead of profile building.

</comment></comment></comment></comment></comment><comment><USER27> So Verizon bought Yahoo a company where every single email account had been known to have been compromised[1], and now they are seeking to monetize those same accounts by scanning their their contents and selling that data to third parties? No wonder the Yahoo hacks and very late disclosure didn't derail the deal. These two basement brands deserve each other.

[1] [https://www.oath.com/press/yahoo-provides-notice-to- addition...](https://www.oath.com/press/yahoo-provides-notice-to-additional- users-affected-by-previously/)

</comment><comment><USER28> Because they know everyone that would have ever left them has already done so. Nothing to lose...

<comment><USER29> Not all users are clued up on whats happening in the tech world, some users are just users who want an email account.

<comment><USER30> Sure, and Google is happy to do that, for the layman or the techie.

There's just no need, or space, for Yahoo anymore.

<comment><USER31> I think the OP's point is that a lot of "legacy" users on Yahoo -- or on Hotmail[1], or on the free email they got from their ISP when they signed up fifteen years ago -- aren't inclined to move to Gmail unless they're tech- savvy enough to understand the case as to why they should. On the surface, free webmail services seem to be pretty interchangeable.

[1]: While Hotmail doesn't technically exist anymore -- it redirects to Outlook.com now -- I know more than one person who got their email account there back when it _was_ Hotmail, still use it, and still refer to it that way. And at least one of those people is someone younger than I am and who's tech-savvy enough to be putting together his own PCs. Anecdata, of course, but I think a good illustration of why services like Yahoo Mail are likely to exist way, _way_ longer than we might think.

<comment><USER32> Yeah, tech in general and especially email is annoying to switch from. My parents still use a yahoo email account because they have had it for so long and don't want to get other people to update their contacts.

</comment></comment></comment></comment></comment><comment><USER33> Isn't Yahoo gone? Shouldn't headline be "Verizon-Oath"?

<comment><USER34> In the same sense that "Google" is gone and we should now be saying Alphabet. That is the holding company, but the brand remains.

<comment> super-serial That's different - Yahoo has completely different owners now whose main business is in a different sector.

Headline should read:

"Verizon after acquiring Yahoo disregards normal tech-company conventions and snoops on everyone's emails like a scummy ISP."

<comment><USER35> what's the point of finely tuning semantics when it's functionally identical?

<comment><USER36> Getting people upset with Verizon is a good goal.

</comment></comment></comment></comment></comment><comment><USER37> They can read all the spam they want ... it's what yahoo email was built for .. of one your trash email addresses!

</comment><comment><USER38> Today the lost hours maintaining my personal mailserver suddenly don't feel so lost!

</comment><comment><USER39> Didn't Yahoo also promise a few years ago it wouldn't do that (only after they saw a backlash against scanning the emails, I believe).

</comment><comment><USER40> I hate yahoo and all these evil companies with their personal data collection fetishes.

<comment><USER41> It's because you're not paying for their services.

<comment><USER42> Most companies sell your data even if you pay.

</comment></comment></comment><comment><USER30> I'm personally shocked Yahoo is still a company.

I personally don't know anyone daft enough to use their services up here in Canada - even in the US (where I have personally seen the 'average Joe's' tech knowledge - especially in central and southern states - shockingly much less than that in Canada) it seemed folks avoided it, except the lowest-of-the-low in terms of tech knowledge.

They have, for the years since AOL was known universally as the worst tech company, seemingly fought for that title.

EDIT: Surprised at the downvotes. I'd love to know why.

<comment><USER43> > since AOL was known universally as the worst tech company

When it started to fail, it was lamented, but technically? It was exploitive and full of dumb subscribers, but the tech was fine.

> except the lowest-of-the-low in terms of tech knowledge.

Used yahoo for decades, since I was around when it started. Still do, for one email address.

<comment><USER44> _but the tech was fine._

Yep, AOLserver was one of the first "app servers" and it was well regarded. The other PG built his company around it.</comment></comment></comment>


More Intuitive Calculator Arithmetic (2018) - <AUTHOR> https://engineering.desmos.com/articles/intuitive-calculator-arithmetic/ <comment><USER2> There's a related very nice article about the calculator in Android, by Hans-J. Boehm: [https://cacm.acm.org/magazines/2017/8/219594-small-data- comp...](https://cacm.acm.org/magazines/2017/8/219594-small-data- computing/fulltext) Small-Data Computing: Correct Calculator Arithmetic

<comment><USER3> Wow, this is better than I've ever expected: Android calculator makes use of Exact Real Arithmetic running in the background (with some tweaks to cope with the inherent undecidability and an infinite list of trailing zeros). I had been fully aware of ERA but never expected to see that in a such widespread application.

<comment><USER4> This looks pretty interesting. Is there any good resource on this?

<comment><USER3> Searching for "Exact Real Arithmetic" will yield some. Specifically, a HaskellWiki page [1] is not too bad as a starting point. Or, if you are keen to academic presentations (read: presentations optimized for the maximal information density and not for the actual presentation ;-) [2] might be better.

You can also take a look at the actual source code for the Android ExactCalculator app [3]. For some reason, however, it is deprecated after Android 9.0.0; don't know why.

[1] [https://wiki.haskell.org/Exact_real_arithmetic](https://wiki.haskell.org/Exact_real_arithmetic)

[2] [https://members.loria.fr/PZimmermann/irram18.pdf](https://members.loria.fr/PZimmermann/irram18.pdf)

[3] [https://android.googlesource.com/platform/packages/apps/Exac...](https://android.googlesource.com/platform/packages/apps/ExactCalculator/+/refs/tags/android-9.0.0_r49/src/com/android/calculator2)

</comment></comment></comment></comment><comment><USER5> This is super neat! Desmos is one of my favorite tools. For anyone interested in efficient rational number representation, I highly recommend the entertaining article on "floating bar" for ray-tracing algorithms by Inigo Quilez

[https://iquilezles.org/www/articles/floatingbar/floatingbar....](https://iquilezles.org/www/articles/floatingbar/floatingbar.htm)

</comment><comment><USER6> > It took a while for us to settle on the idea of using rationals with > limited-sized integers for the numerator and denominator and falling back to > binary floating point when we have to. I doubt this idea is original—it's a > combination of a few well-established ideas—but I'm also not aware of any > calculator (or programming language) that currently works this way.

I am fairly sure this is exactly how my calculators (a Casio fx-115ES PLUS and a TI-89) work…

<comment><USER7> I don't have any experience with Casio calculators, but my recollection of the TI-89 and HP's competitors that have computer algebra systems is that by default they won't switch your data from rationals to floats without asking or alerting you.

However, if you input a number containing a decimal point it will be represented as a floating point number and performing arithmetic between that and a rational will cause the rational to be coerced to a floating point number and yield a floating point result. (If you're working with a more complicated expression, you can sometimes end up with some terms/coefficients of the expression being rational numbers and some being floats, until you ask for the expression to be fully evaluated down to a numerical result.)

<comment><USER6> They will fall back if they cannot represent the number as a rational; I just pulled them out and had them do \sum_{x=1}^{1000}\frac{1}{x^2} and they both gave me a decimal result.

</comment></comment></comment><comment><USER8> "I'm also not aware of any calculator (or programming language) that currently works this way." [represent fractions exactly wherever reasonable to do so]

This is surprising to me!

Casio scientific calculators definitely do this, and have done for many years now. And Casio (it appears) also represents pi and square roots exactly/symbolicly, wherever it's reasonable to do so.

<comment><USER9> Yeah, they just lack exposure to systems that do:

      :; sbcl
      This is SBCL 1.5.5, an implementation of ANSI Common Lisp.
      ...
      * (/ 1 3)
      1/3

<comment><USER10> To be fair that is a pretty recent addition to Lisp, only added in the late 1970s. They might not be keeping up with the latest stuff.

</comment></comment></comment><comment><USER11> tl;dr "We switched from floats to rationals."

Because we made out calculator in JavaScript.

Relatedly, lately I've been thinking of floats not as numbers but as number intervals. Their arithmetic doesn't really work that way but it's much better intuition for all the weirdness.

<comment><USER12> Yeah, a float isn't a number, it's a number with an error bar.

<comment><USER13> One awkwardness with interval arithmetic is that after twenty or thirty multiplications the error bar can get large enough to make the answer not useful.

Twenty or thirty is not a large number in many reasonable calculations, for instance with finite element calculations or Markov chanis.

<comment><USER12> This is actually a really important factor that a lot of code just ignores. Floats are decent general purpose numbers for a lot of uses but they come with a whole bunch of caveats where you can lose a lot of precision really fast.</comment></comment></comment></comment>


So now apparently, only Chrome is supported on Google properties - <AUTHOR> https://twitter.com/kangsterizer/status/389817663335047168

<comment><USER2> Sensationalist headline, sensationalist tweet.

If you actually click through to the image - [http://i.imgur.com/cxFFE3W.png](http://i.imgur.com/cxFFE3W.png) \- it's plainly clear that this is just yet another case of "hey, the browser upgrade nag code doesn't recognize my nightly build."

</comment><comment><USER3> Yeah, I noticed this.

Gmail, Google Groups and other applications have been incompatible with IE for the last few months.</comment>